e22854a5f93a9bce2c8dcffd9e177925074bb0e0972566d673e4b83022c9a46c

Analysis

max time kernel
149s
max time network
157s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 09:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v1A-m2-eL.svg
Size 3KB
Sample260816-lkyamsvset
SHA256 e22854a5f93a9bce2c8dcffd9e177925074bb0e0972566d673e4b83022c9a46c
MD5 735c5dd9687af27db46d1760af81d1a5
SHA1 0362449843acc75186d102a08af6cf07a5b90853
SHA512 26772d0a891c6a143982ad5a722edd3afac15222392ad8c66bec616770bd539ac0f223fe367a8615d39c4c5ff3ffbaccfd34400adc4c2fd98fac718edffb22b1
TLSH
T1AA71288876F83EEBD7D802970D41D4B84B2F946BD822978DD3CB94E875282AC735D570
MD5 SHA1 SHA512 TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_1559097028\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_317479259\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_1559097028\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3316	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134313465837936355"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{16915687-23FC-4415-B5CC-89EA762432ED}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1036	msedge.exe
1036	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4788	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 4788	2032	iexplore.exe	89
PID 4788 wrote to memory of 3644	4788	msedge.exe	90
PID 4788 wrote to memory of 3316	4788	msedge.exe	91
PID 4788 wrote to memory of 4628	4788	msedge.exe	92
PID 4788 wrote to memory of 4628	4788	msedge.exe	92
PID 4788 wrote to memory of 4628	4788	msedge.exe	92
PID 4788 wrote to memory of 4900	4788	msedge.exe	93
PID 4788 wrote to memory of 4900	4788	msedge.exe	93
PID 4788 wrote to memory of 412	4788	msedge.exe	95
PID 4788 wrote to memory of 412	4788	msedge.exe	95
PID 4788 wrote to memory of 412	4788	msedge.exe	95
PID 4788 wrote to memory of 356	4788	msedge.exe	96
PID 4788 wrote to memory of 356	4788	msedge.exe	96
PID 4788 wrote to memory of 356	4788	msedge.exe	96
PID 4788 wrote to memory of 2576	4788	msedge.exe	97
PID 4788 wrote to memory of 2576	4788	msedge.exe	97
PID 4788 wrote to memory of 2576	4788	msedge.exe	97
PID 4788 wrote to memory of 1036	4788	msedge.exe	98
PID 4788 wrote to memory of 1036	4788	msedge.exe	98
PID 4788 wrote to memory of 1036	4788	msedge.exe	98
PID 4788 wrote to memory of 3576	4788	msedge.exe	100
PID 4788 wrote to memory of 3576	4788	msedge.exe	100
PID 4788 wrote to memory of 1804	4788	msedge.exe	101
PID 4788 wrote to memory of 1708	4788	msedge.exe	102
PID 4788 wrote to memory of 1804	4788	msedge.exe	101
PID 4788 wrote to memory of 1708	4788	msedge.exe	102
PID 4788 wrote to memory of 5384	4788	msedge.exe	104
PID 4788 wrote to memory of 2076	4788	msedge.exe	105
PID 4788 wrote to memory of 2076	4788	msedge.exe	105
PID 4788 wrote to memory of 4220	4788	msedge.exe	108
PID 4788 wrote to memory of 4220	4788	msedge.exe	108
PID 4788 wrote to memory of 5084	4788	msedge.exe	110
PID 4788 wrote to memory of 2480	4788	msedge.exe	111
PID 4788 wrote to memory of 3564	4788	msedge.exe	112
PID 4788 wrote to memory of 724	4788	msedge.exe	113
PID 4788 wrote to memory of 724	4788	msedge.exe	113
PID 4788 wrote to memory of 2276	4788	msedge.exe	117
PID 4788 wrote to memory of 2276	4788	msedge.exe	117
PID 4788 wrote to memory of 1036	4788	msedge.exe	118
PID 4788 wrote to memory of 1820	4788	msedge.exe	119
PID 4788 wrote to memory of 1820	4788	msedge.exe	119

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v1A-m2-eL.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v1A-m2-eL.svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x310,0x7ffcd35ac188,0x7ffcd35ac194,0x7ffcd35ac1a0
    3⤵
    PID:3644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1924,i,7047634834813120401,15471496459126987453,524288 --field-trial-handle=2652,i,15982850981628939504,8604917725755647491,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,15748980346499071493,920951269766737297,262144 --field-trial-handle=2652,i,15982850981628939504,8604917725755647491,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:2
    3⤵
    PID:4628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2376,i,17480198509116313460,16714675160832716811,524288 --field-trial-handle=2652,i,15982850981628939504,8604917725755647491,262144 --variations-seed-version --mojo-platform-channel-handle=2804 /prefetch:13
    3⤵
    PID:4900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3560,i,9044156381385471642,11870338431295116523,2097152 --field-trial-handle=2652,i,15982850981628939504,8604917725755647491,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
    3⤵
    PID:412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3568,i,1227513682297777837,2424828546038738240,2097152 --field-trial-handle=2652,i,15982850981628939504,8604917725755647491,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
    3⤵
    PID:356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4360,i,9753911981719542953,14583264500948812416,2097152 --field-trial-handle=2652,i,15982850981628939504,8604917725755647491,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:1
    3⤵
    PID:2576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4372,i,34709278695559877,9594402062388551614,2097152 --field-trial-handle=2652,i,15982850981628939504,8604917725755647491,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:9
    3⤵
    PID:1036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3688,i,13340995115767832174,615111605980832238,524288 --field-trial-handle=2652,i,15982850981628939504,8604917725755647491,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
    3⤵
    PID:3576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,7559229029148592675,17175781372979954040,524288 --field-trial-handle=2652,i,15982850981628939504,8604917725755647491,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:14
    3⤵
    PID:1804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,14647427568560770257,16807103589708811600,524288 --field-trial-handle=2652,i,15982850981628939504,8604917725755647491,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:14
    3⤵
    PID:1708
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,23568589382590625,18035877235815118207,524288 --field-trial-handle=2652,i,15982850981628939504,8604917725755647491,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:14
    3⤵
    PID:5872
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,23568589382590625,18035877235815118207,524288 --field-trial-handle=2652,i,15982850981628939504,8604917725755647491,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:14
    3⤵
    PID:5384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,4065796187309856580,3730911797406480074,524288 --field-trial-handle=2652,i,15982850981628939504,8604917725755647491,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:14
    3⤵
    PID:2076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,9070675775237718134,4027488151779205121,524288 --field-trial-handle=2652,i,15982850981628939504,8604917725755647491,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
    3⤵
    PID:4220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,2880940379315035613,8006526229549244897,524288 --field-trial-handle=2652,i,15982850981628939504,8604917725755647491,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:14
    3⤵
    PID:5084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,7193581589857110971,3449674971786199629,524288 --field-trial-handle=2652,i,15982850981628939504,8604917725755647491,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:14
    3⤵
    PID:2480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4440,i,10251940950434250987,5199877740137001953,524288 --field-trial-handle=2652,i,15982850981628939504,8604917725755647491,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:14
    3⤵
    PID:3564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,3883551159199253177,8081249097984817665,524288 --field-trial-handle=2652,i,15982850981628939504,8604917725755647491,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:14
    3⤵
    PID:724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4460,i,2799793927818560431,4579754300424087076,524288 --field-trial-handle=2652,i,15982850981628939504,8604917725755647491,262144 --variations-seed-version --mojo-platform-channel-handle=920 /prefetch:14
    3⤵
    PID:2276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2308,i,14801480211466568068,1122266740886538109,262144 --field-trial-handle=2652,i,15982850981628939504,8604917725755647491,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,9020436867559117068,14216831509313035151,524288 --field-trial-handle=2652,i,15982850981628939504,8604917725755647491,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:14
    3⤵
    PID:1820

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 b272682ea7906ec234a6adc97e866d560199bebccc90035515a0506daa0cbc06
MD5 2087307a98b68b7455e5b6644cd1f9a3
SHA1 5d88b0b7fb83ec055322678c804aba5282ce7133
SHA512 e552a0107a66abdfc9962bce37c7382a3e669bf5b4fc9be6fecd515362f46a954409460e0d29930c8e1cf7c0244a03613787b1a6084a6a6c12161668dbb2f5b8
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7b:fwUQC5VwBIiElEd2K57P7b
TLSH
T18EB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 08a3eccff4cd9b05162ffe0d083662ea8cd60457899147f42dbbf95a0a97d97e
MD5 394c25b8b347a39d61b9cf28babb5c77
SHA1 c7334bcf8642ac580d30cf31659724fe1ab323c9
SHA512 8e5c09dada01bf020bbf53884d65940c521dc62e17d9ce99fe6c571edde4b95c7c7716f2eda97b70568b2cbac8823e7afed5a9bac7be39d1acc6fc95c23a4b1c
TLSH
T1F6D0C038762962C2C92725B2CC3063007330007030B587425071440C8E3489667CF3C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 168dc438fa355b9b84e416f9d4caca14da218ad190d72da09fe489277625815d
MD5 39064a84dfec9bbd8c4b789b6d7a7c62
SHA1 5d817a4df5ed7bd1eac0c4bc0464a76007ad0c46
SHA512 3a4f32a1ad3eb6c391e6d11f4f6ba07c4d21cc935ddd8fd93306857b9e0cfda06c39786a872cae88f394320921a63296ad4df0e61334710db192febec2f48618
TLSH
T1B5D0C034763961C2C92725B2CC3163007320007030B587425171840C8E3489667CF3C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 72a7ee28d6204cf69567fd28fcd93df60b7d65253c919639b6be368c10c45975
MD5 ee0a868ab7dbdab0152e971037836cb2
SHA1 bd67386b249aa516b4d1a2aed1a4722c0d5d0870
SHA512 70b62a6d4efd1152d9300893c05fae504caab09c6f3f05c0dbb72b3781752bc61ecd1e0015f30acc77fba93357f6d30137c3749e4dbd355f1d167384068e980e
TLSH
T15A313C90336408F7D7909DF214F84AC7313CA7BC06076E11D484A33F48B7764BD12029
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 4f759e4cfe171fc1013073fc7d057dd65807dcf4085ca9597944bc969279638a
MD5 d8afd8eb81ef11572503efbaae673d61
SHA1 e15392c338399b7d1b5d84ca7f9382d466212155
SHA512 dc0b003ee1a5c2bc11f1027606174fef72a3b294d1dfb68c32d87cdd51b82949e09ae92fa5974484815e9c0336ed00ac1063058e8798cbd243b7411a1a725173
TLSH
T12631A0F783F4957E8A1195F4AA086F1FCE2C0551432C7D5AC5E0AE2B93E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 6bb2e1493b320cf964fa8f70a366ce9ef881b48bd55b05f27730acb57ee9a690
MD5 b952936dfd1d23fbad39e956203fb5b4
SHA1 1e7b5927a6988ac3d5584af5d25d8947f7adf4ba
SHA512 a3f8bd81fcfc893629bd7016c976903093c275f93d2d11331872b363d8e6e9fe6bc51d48fd5025fbee86377b5896870d019fe61e82a5452eeda0d0a571fc5f26
SSDEEP 192:sxRURSyM/jK1Ml8UQ4CE/fVsgdkQcZ1KIjOzoA8pe2/g6+WNIYZ7PPEt1fG6IgDU:sxRUQq/E/fVsgdkQi1KMzR/5Invw
TLSH
T14B62D715AA24997BDCDBD60DFA557F53D2F86532A1900E44AEFCCA1C00E76DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 392aa4a95dab7ce2b144d67136e4dda8cc7a29b1756da7764aa3b3b228be3e53
MD5 a601ee14cd32bc5c13df0217c3f2e044
SHA1 a5c7d15b9c6df8e481979d3b43450608b5888468
SHA512 f9f04ae4971ace4ceca83a7e8ff7cbdc493f4dfa64cbb2f6babc875c36e427ce63fe586a3784f62f834e8ac8fe688014e88ae3278255356fa60b9d9b49568a9a
SSDEEP 192:sxR7RSyM/jK1Ml8wCE/fVsbkIcZ1KIjOzoA8p42/g6+WNIYZ7PqEt5fG6IgVK4J:sxR7Q8E/fVsbkIi1KMzT/5ImvV
TLSH
T15362D9156A24A97BDCDBD20DFA557F53D2F81563A2901E44AEFCCA1C00E66DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d69ccd261a0895566eafd08dc918cf7d05e3fddf02450d82e1a4a39a3e4d712f
MD5 9e3e9687cab86ff1e0375e90fa84ea52
SHA1 72661dbcf412e95220bbf59101651b6ec0d3ad34
SHA512 9adf48156ace4d99a10153c0ebae383d927eb4b7d6cbe0fe5eff5c54de3830e0db72356b80679422a869072f334e4330a1d706b7400711810a53b3cf41b99f27
SSDEEP 192:sxRURSyM/jK1Ml8wCE/fVsgdkIcZ1KIjOzoA8p42/g6+WNIYZ7PqEt5fG6IgDAKc:sxRUQ8E/fVsgdkIi1KMzT/5ImvW
TLSH
T1FF62D815AA24997B9CDBD20DFA557F53D2F81562A2901E44AEFCCA1C00E66DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 53d476f4eb06f063d759dc286d076e4b3f1fb91bd58200c532120f4871ee66d8
MD5 cf2fb843156de3c5a844f24a8f1a624f
SHA1 11ff97bc349470662ec113d7697faef5da1d6288
SHA512 768fc4a78bae1d431c27facdef14f287cddd5bae574f910bf56f43b7f18f5252448b0ab2396c7c9d51bc7fa21c3d3d7fa531d8222e535000f7139aed64586fd3
SSDEEP 768:kfISaS7pLuL7CvWgd5fWb8F1+UoAYDCx9Tuqh0VfUC9xbog/OVqutSV22roHh0s6:kfISaqE7CvWgd5fWbu1jaZutU2NHh0s6
TLSH
T1F4E2EC3B680CCB7F4F8049DCEC297E9AADA802CF96D8CD5447EA850C03C66EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3cf8d7e1481135481293bad63f83521e577bdc047590e11984ca320ce9069991
MD5 7ad58e411d328da68c7915bc052a6b6f
SHA1 65498d257ead4bc0cdbb9ae88a1f35fe97760f6d
SHA512 7ef7306adf2dbfc9e10b0bcedd04751b470f6331ae9867b0521f1849d916faf0020fe0b161f0ce9a694b6be6c214fcc32414fe502d2121fbdceadf50f084d1e1
SSDEEP 24:KSi5EiBikimPijSiAisiv1ikiDDimI4iIivKXiIhPiiiv1Ri+i/SriR5iEJicikl:Kc2IfKbiIzytPIVKcko0rIlKA8gvyc
TLSH
T13C9103D5757A82503CBF250C81B9CA6786C271B37058E92B7FA815E15FABE120EFC4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a0495.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a0495.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 5c37afb58fcf1d17628032c4e16cbe29f357bf58ddd398196b0402c5cc4faecc
MD5 dbfecbacd66202b74bfbb3d32e362ce9
SHA1 88f6a3328cfd766afc342f5bd74c9336e2c300ea
SHA512 48b34139cefd0ec74796b13bc95522374fde35b02b2e4a772e978ed9da59474db67f017d04cc9bbbd6929b31779d413fda848389eb6023555ecbd6fbdcb99f7a
SSDEEP 768:l53Zxq9LLHLYHAam6aQMGdjWca4Ghf9z4f:l53phmaME6pza
TLSH
T170E2AE705CA8D9739CABB695F76B2383BEF0617388C84E84D8D99B0D029354E2707D1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 650b32a525518998a93355d715d852e0e74af4e04dfe3a2b5facd57ba692e981
MD5 e2985b068fba53bbdf260e0e6062530f
SHA1 ea170b10ec0b536c4067f924d8d43f3a5ed84de2
SHA512 bcfc05a35c8ffb2e769d62960a82f49c9f1a02a544d5e6c3452e40cdb65ac03b4dc79c042d2f8940c0b3acebf41d7d45cdbe2206acb361bfa89f205243e38de1
SSDEEP 768:GFQa3Rwg7VzLLHLlAam6aQMGdjWca4Ghf9z4f:Na35maME6pza
TLSH
T1A5F26B719CA8CA77ACE7ABD5F71A7687EEF011A388C88DC4D9D85D0D019318E170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 62a17832d3df50171143432a2e64742ac9c34ee123a1fc906ffa51780f7e2897
MD5 5e74e602980c49b42d107e7cb95929b8
SHA1 dd792c9af305fd5f2470089c9d61a8b83bd7757d
SHA512 6bc7e035dfee7b329d228855021849911cf54b7c72f937441a04249daf81b2acd2e571e8e66579526f4076617b9e08fb3265814b64624876abdbd7add9a2ac9a
SSDEEP 768:/rv+4UNbdq3EJq9LLsAAam6aQMGdjWca4GhfBCPeU/:/bsbc3WKmaME6p6H
TLSH
T1D1F2BF31A86C9973DDB79A99F21B6787BFF021A385D40A80D9D82B0D439708E3307D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 edeabdcd6c2d8a6519b18b86253f1d0b8a24a6ef62d16e364975e3b31b96b8fb
MD5 2fa9d7c6569ecde3875170c6bd0a4353
SHA1 8c6d76a7c6d0447845d5d17a64d0080c50cf51d4
SHA512 934260cfa7b252f76af4281488f564167c77bd188092a1ef5874e2bd9eaf25c305f7746845a1d0be6e52afe352052a82bc0ae2a25cfcbc7a94b8b1d9892ff024
SSDEEP 768:A53rxq9LLHLYHAam6aQMGdjWca4Ghf9z4f:A53jhmaME6pza
TLSH
T189E2AF705CA8D9739CABB695F76B2387BEF0617388C84E84D8D99B0D029354E2707C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 8ec458d373f49822ff5fd0d4ca38d7991b8dc19609f0d74aac23e3735cbf0a9b
MD5 79cefa193fd51be1531a17fdebffb92e
SHA1 27fc0ef865942dfd0d75ecdc247f391ae2edf355
SHA512 2b1c4a76f5002ddb11c7585923113efa8a1208d2928a01cb932e0e19959792543ec6e6105127f1f310b2922c30f61172a93a6e07e5b7f130b847557f895d8bb1
SSDEEP 768:rrv+4UNbdq3F/q9LLHLY0Aam6aQMGdjWca4GhfwzPeU/:rbsbc3HWmaME6pQH
TLSH
T172F2BF31A86CD9739CB7A695F25B6687BEF021B388C40E84D9D96B0D439708E370BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

86150c77-f6e1-40ad-bc91-3172d46291e3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\86150c77-f6e1-40ad-bc91-3172d46291e3.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4788_699824654\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download